SMS two-factor authentication for WordPress

What it does

For teams where authenticator apps are a hard sell, SMS is the second factor people already understand: log in, get a text, type the code. It slots into the same 2FA framework as the free email and app methods.

How it works

Connect your Twilio credentials: account SID, auth token and a sender, which can be a phone number, an alphanumeric sender ID or a Twilio Messaging Service. Codes are six random digits with a five-minute expiry, deleted on success or expiry, and verified with timing-safe comparison. Delivery only happens for user roles you select, and Twilio errors are translated into messages a human can act on.

The shared 2FA rate limiter applies here too: five failed attempts earn a fifteen-minute lockout, so codes cannot be brute-forced.

• Twilio number, alphanumeric sender ID or Messaging Service SID
• Role-gated delivery: pick exactly who can use SMS
• Six digits, five-minute expiry, single use
• Shared 2FA rate limiting: 5 attempts, 15-minute lockout
• Send and verify events logged with masked numbers

Honest guidance

SMS is more phishable than authenticator apps or passkeys. SIM-swap attacks are real. Our own ordering: passkeys first, authenticator apps second, SMS where the alternative is no second factor at all. All three live in the same plugin, so upgrading a user later is a settings change.